Vulnerability Details : CVE-2013-0339
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.
Vulnerability category: XML external entity (XXE) injectionDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2013-0339
Probability of exploitation activity in the next 30 days: 1.86%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 87 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-0339
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2013-0339
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-0339
-
http://openwall.com/lists/oss-security/2013/02/21/24
oss-security - CVE Guidance for Libraries and Resource-Consumption DoS
-
https://bugzilla.redhat.com/show_bug.cgi?id=915149
915149 – (CVE-2013-0339) CVE-2013-0339 libxml2: CPU consumption DoS and other effects when performing string substitutions during external entities expansion
-
http://www.ubuntu.com/usn/USN-1904-1
USN-1904-1: libxml2 vulnerabilities | Ubuntu security notices
-
http://openwall.com/lists/oss-security/2013/02/22/3
oss-security - CVEs for libxml2 and expat internal and external XML entity expansion
-
http://www.ubuntu.com/usn/USN-1904-2
USN-1904-2: libxml2 regression | Ubuntu security notices
-
http://seclists.org/oss-sec/2013/q4/188
oss-sec: Re: CVE Request: libxml2 external parsed entities issue
-
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
[security-announce] SUSE-SU-2013:1627-1: important: Security update for
-
http://seclists.org/oss-sec/2013/q4/182
oss-sec: Re: CVE Request: libxml2 external parsed entities issue
-
https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f
Do not fetch external parsed entities (4629ee02) · Commits · GNOME / libxml2 · GitLabExploit;Patch
-
http://www.debian.org/security/2013/dsa-2652
Debian -- Security Information -- DSA-2652-1 libxml2
-
http://seclists.org/oss-sec/2013/q4/184
oss-sec: Re: CVE Request: libxml2 external parsed entities issue
-
http://www.openwall.com/lists/oss-security/2013/04/12/6
oss-security - Re-evaluating expat/libxml2 CVE assignments
Products affected by CVE-2013-0339
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.14:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.16:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.9:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.19:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.27:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.28:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.20:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.21:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.29:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.10:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.13:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.17:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.18:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.24:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.25:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.26:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:1.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.0:beta:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.16:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.22:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.23:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.30:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.5.11:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.27:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.20:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.22:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.18:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.17:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.16:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.32:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.26:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.30:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.25:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.31:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.24:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.23:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.29:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.21:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.6.28:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.9.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:2.8.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*